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Appl. No.: 10/039,992 ' 

Amdt. Dated October 26> 2005 

Response co Office Action of June 28. 2005 

Amendments to the Claims : 

This listing of claims will replace all prior versions, and listings, of claims in title 

application: 

Listing of Claims : 

1- (currently amended) In a hierarchical classification system including a 
classification tree comprising a plurality of traffic classes, wherein at least one traffic 
class of the plurality of traffic classes corresponds to a first classification type and at 
least one other traffic class in the plurality of traffic classes corresponds to a second 
classification type, wherein the classification tree further comprises a cache storing a 
data structure representing a cacheable portion of the classification tree, wherein the 
data structure corresponds to the at least one traffic class of the first classification type 
performing caehing, a method comprising: 

walking [[a]] tiie classification tree in a hiorarchical classification jyotom to 
determine whether an mcoming flow matches a traffic class in the classification tree; 
and 

upon encountering the cacheable portion of the classification tree, performing a 
lookup on [[a]] &xe cache storing a data structure of a plurality of classos of one 
claPDification type to compare the incoming flow with a plurality of the at least one 
traffic class of the first classification type classes at tho same time to determine whether 
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the incoming flow matches one of the plurality of clasGos at least one traffic class . 

Z (original) The method defined in Qaim 1 wherein the data structure comprises a 
hash table. 

3. (currently amended) The method defined in Claim 1 further comprising 
rehiming a class pointer indicative of user programming information that has been 
assigned to a traffic.class if the incoming flow matches the traffic class, 

4. (currently amended) The method defined in Claim 1 further characterized by 
performing a walk through the plurality of traffic c lasses in the classification tree if a 
determination that the traffic class in the at least one plurality of traffic dass cloflscD is not 
known as a result of performing the cache lookup. 

5. (currently amended) The method defined in Claim 4 wherein if the class of the 
incoming flow packet hits the cache, then further comprising: 

storing the class in the cache; and 

returning a result indicating the incoming flow g lass was in the cache. 
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6. (currenfly amended) The method defined in Qaim 4 wherein if the class of tho 
incoming flow packet dooo not hit hits the cache and no traffic class is identified, further 
comprising: 

marlcing tho cache result as indicating that tho class is notin thc cache; and 

continuing to walk the classification tree from a location in the classification tree 
immediately after the end of the cacheable p ortion of the dassification t ree represented in 
the cache. 

7. (currently amended) An apparatus for use in a hierarchical classification 
system performing caching, the apparatus comprising: 

a memory storing a classification tree comprising a plurality of traffic classes, 
wherein at lease one traffic class in the plxirality of traffic classes corresponds to a first 
classification type and at least o ne other traffic dass in the plurality of traffic classes 
corresponds to a second dassification type: 

a cache operative to store a cacheable portion of the classification tree , wherein 
the cacheable portion of the classification tree corresponds to at least one traffic dass in 
the plurality of trgiffic classes of the first dassification type: and 

a dassification engine coupled to the memory to walk the classification tree as 

part of o hiororchical classification system to determine whether an incoming flow 
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matches a traffic class in the classification tree, an d, when the cacheable portion of the 
classification tree is encountered, to perform a lookup on the cache storing - a - data 
structure of a plurality of classes of ono dag s ification typo to compare tho incoming 
flow tvith a pluralit)^ of dassos at the same - tim e to determine whether the incoming 
flow matches one of the at least one traffic classes of the first classification type 
plurality of claooop . 

8- (original) The apparatus defined in Claim 7 wherein the data structure 
comprises a hash table. 

9. (currently amended) The apparatus defined in Claim 7 wherein the classification 
engine returns a dass pointer indicative of user programming information that has been 
assigned to a traffic class if the incoming flow matches the traffic class. 

10. (currentiy amended) The apparatus defined in Claim 7 wherein the 
dassification engine performs a walk through the cacheable portion of the classification 
tegg -plurality of dassos if a determination that the traffic d ass corresponding to the 
incoming flow i n tho pluralit}^ of daoGOG is not know^n as a result of performing the cache 
lookup. 
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11. (currently amended) The apparatus defined in Claim 10 wherein if the clafis of 
^ incoming flow pad^ot hits matches a traffic class corresponding to a cacheable portion 
of the classification tree the cacho . then the classification engine: 

creates an entry in the data structure including an attribute of the incoming flow 
defined by the first classification type and the matching traffic dass: and 
GtOTos the traffic dass in the cacho; and 

returns a result indicating the matching traffic dass was in tho cache . 

12. (currently amended) The apparatus defined in Claim 10 wherein if the clasp of 
the incoming flow padtct does not match a traffic class in the cadieable portion of the 
dassificatLon tree hit iho caohQ . then the classification engine: 

creates an entry in the data structure including an attribute of the incoming flow 

defined by the first cl a ssification type and an indication that m ark^ tho mchp rnnult- nr , 
indicating that the class is not in the cache; and 

continues to walk the classification tree from a location in the tree immediately after 
the end of the cacheable p ortion of the classification tree represented in the cache. 

13. (currently amended) An apparatus for use in a hierarchical classification 

Page 7 of 18 

PAGE 10/21 * RCVD AT 1/3/2006 4:32:13 PM [Eastern Standard Time] * 8VR:USPTO-EFXRF4/26 * DNIS:2738300 * CSID:415 480 1780 * DURATION (fnfn^s):05-38 



Jan 03 06 02:32p Mark J. Spolyar 415-480-1780 p.11 

Appl. No.: 10/039,992 

Amdt Dated October 26, 2005 

Response ro Office Action of June 28, 2005 

system performing cachirxg, the apparatus comprising: 

a memory storing a classification tree comprising a plurality of traffic classes. 

wherein at lease one traffic class in the plurality of traffic classes corresponds to a first 
classification type and at least one other traffic class in the plurality of traffic classes 
corresponds to a second classification type: 

a cache operative to store a cacheable portion of the classification tree, wherein 
the cacheable portion of the classification tree corresponds to at least one traffic class in 
the plurality of traffic classes of the first classification type: and 
a classification engine operative to: 

determine, relative to the first classification type, whether the cache 

contains an entry matching an incoming flow: 

conditionally walk, if no entry is found in the cache^ the cacheable portion 

of the classification tree to match the incoming flow to the at least one traffic class, and 
then: 

create, if tt\e incoming flow does not match one of the at least one traffic 

class in the cacheable portion of the classification tree, an entry in the cache indicating 
that the incoming flow, relative to the first classification type, does not match a traffic 
class in the cacheable portion: or 

create, if the incoming flow hits one of the at least one traffic class in the 
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cacheab le portion of the classification tree> an entry in the cache> based on the first 
dassificat ion type> corresponding to the incoming flow and the matching traffic class. 

means for ^yalldng a clasGification troo in a hiGrarchical classification oyctom to 

dotormino whether an incoming flow matchoo a class in tho daspification troo; and 

moans for performing a lookup on a cache storing a data otructuro of a plurality 

of claosGS of one dasoification typo to compare tho incoming flow with a pluralityHs rf 
claQOOO at ttio Game time to dotormino whether the incoming flow matchoo one of the 
pluralit>^ of classoo. 

14. (canceled) 

15. (currently amended) In a hierardiical classification system performing caching, 
a method for classifying a flow comprising: 

ordering a classification tree including a plurality traffic classes, wherein at least one 
traffic class corresp onds to a first dassification type, and wherein at least another traffic 
class corresponds to a secon d dassification type e f dasr,ificatinn typnr . by grouping at least 
a portion of the traffic classes of each dassification type of dasoification together in the 
classification tree; 

creating a first data structure , representing a first cacheable portion of the 
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classification tree, of a plurality of tratffic dasses of eae the first classification type to 
facilitate determination of dQtormino whether the flow matches any traffic classes i teHftS in 
the first data structure; 

creating a second data structure, representing a second cacheable portion of the 

classification tree, of a plurality of traffic classes of the second classification type to 
facilitate detennination of whether the flow matches any fraffir rlasses in the second data 
structure. 

performing troo walking of the classification troo; and 

performing a looloip on a cocho storing the data stcucturo to compare the 

incoming flow with a plurality - of claflsog at the same time to dctcrmino whether the 
incoming flow matdxoo one of - the plurality of classGS. 

16. (currently amended) The method defined in Claim 15 wherein the first data 
structure comprises a hash table. 

17. (currently amended) The method defined in Claim 15 wherein the first 
classification type lypes in the classification tree includes network addresses. 

18. (currently amended) The method defined in Claim 17 wherein the second 
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classification type ^ pes in the classification tree includes one or more network services. 

19. (currently amended) The method defined in Claim 18 wherein the second 
classification type typOG in the classification tree further include on or more ports. 

20. (currently amended) The method defined in Claim 17 wherein the network 
addresses comprise Internet Protocol (IP) addresses. 

21. (canceled) 

22. (new) The method of claim 1 further comprising 

conditionally walking, if no entry is found in the data structure, the 
cacheable portion of the classification tree to match the incoming flow to the at leeist 
one traffic class, and then: 

creating, if the incoming flow does not match one of the at least one traffic 

class in the cacheable portion of the classification tree, an entrj' in the data structure 

indicating that the incoming flow, relative to the first classification type, does not match 

a traffic class in the cacheable portion; or 

creating, if the incoming flow matches one of the at least one traffic class 
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in the cacheable portion of the classification tree, an entry in the data structure, based 
on the first classification type, corresponding to the incoming flow and the matching 
traffic class. 

23. (new) The apparatus of claim 13 wherein the cache comprises a hash table. 
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